CVE-2023-4407

published 2023-08-18

CVE-2023-4407: A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file…

Priority P2 61 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument date1/date2 leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-237511.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
codecanyon	credit_lite	—	—
credit_lite_project	credit_lite	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /portal/reports/account_statement↗

command date1=2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(5)))a)XOR'Z↗

command date2=2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(9)))a)XOR'Z↗

• → Monitor POST requests to /portal/reports/account_statement for SQL injection patterns in the 'date1' and 'date2' parameters, specifically time-based blind SQLi using XOR and SLEEP payloads. ↗
• → Detect time-based blind SQL injection attempts using MySQL SLEEP() function embedded in XOR expressions within POST body parameters. ↗
• → Flag POST requests to the account_statement endpoint where date1 or date2 parameters contain single quotes, XOR operators, or SELECT/SLEEP subqueries rather than valid date values. ↗

• · The exploit was tested on Windows 10 Pro; behavior on other OS deployments of Credit Lite 1.5.4 may vary. ↗
• · The injection is exploitable only via authenticated or semi-authenticated POST requests that include a valid CSRF _token; unauthenticated blind scanning may not trigger the vulnerability without a valid session token. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89